Quantum Academy is now open. Enroll in live online training – see the schedule.
Skip to content
Quantum Academy
Search Close search

Try a course name, a credential code such as PQCM, or an industry such as financial services.

Browse courses

How to Use the PQC Readiness Scorecard

Post-Quantum Cryptography

Quantum Academy7 min read
How to Use the PQC Readiness Scorecard

The PQC Readiness Scorecard is a free browser tool for assessing how ready an organization is for post-quantum cryptography (PQC). PQC replaces the public-key algorithms, such as RSA and elliptic-curve cryptography, that a large enough quantum computer could break. You answer questions about the organization’s migration program. The scorecard then shows the organization’s readiness level, its gaps and the regulatory deadlines that apply to it. Your answers stay in your browser.

Marin Ivezic created the scorecard and first published it on PostQuantum.com. QuantumAcademy.com publishes it with permission from Marin Ivezic and PostQuantum.com. You can open it on our Tools page.

Course participants can use it in two ways. You can assess your own organization, or you can work through a case-study company and compare results with classmates. The seven exercises at the end work either way.

What the scorecard measures

The scorecard follows the PQC Migration Framework v3.0, published by Marin Ivezic and Applied Quantum. In the framework, a migration program has seven domains:

  • Cryptographic Inventory: where the organization uses cryptography, and how completely it can prove it. The top level is a cryptographic bill of materials (CBOM) that every production change updates.
  • Governance & Ownership: who owns the program, how it is funded and what the board sees.
  • Pilots & Deployment: what already runs post-quantum cryptography, and whether anyone has observed it working in production.
  • Vendor & Supply Chain: whether the vendors and providers the organization depends on will move, and on what dates.
  • Compliance & Standards: which dated obligations apply, and whether the organization can show evidence that it meets them.
  • Crypto-Agility: whether the organization can change an algorithm on a planned date, tested by rehearsal.
  • Risk & Prioritization: how the organization decides what to migrate first. Organizations score two exposures separately in this domain. Harvest now, decrypt later (HNDL) means an attacker records encrypted data today to decrypt it once a quantum computer can. Trust now, forge later (TNFL) means signatures accepted today could be forged later.

Each domain gets a level on the framework’s scale from 0 to 5. The levels are Unaware, Aware, Initiated, Progressing, Advanced and Optimized.

How the scoring works

You answer each question with Yes, Partial, No or Don’t know. A few questions also offer N/A, for things an organization may not have.

The scorecard awards a level to a domain only if every question at that level and at all lower levels has a Yes or N/A. Partial and Don’t know never count toward a level. An unanswered question does not count either, but the scorecard never records it as a No. If fewer than 80% of a domain’s questions are answered, the scorecard marks the domain as provisional.

The organization’s readiness level is the lowest of its seven domain levels. In the framework’s words, “the weakest domain constrains overall readiness.” An organization with a funded program and no cryptographic inventory therefore stays at a low readiness level.

Crypto-Agility also appears as a second headline result. You may have migrated much of your estate while still being unable to change an algorithm when you choose.

There are three question sets:

  • Quick: 35 questions, one for each level in each domain, about ten minutes.
  • Standard: 63 questions, about 20 minutes.
  • Full: 87 questions, about 30 minutes.

Eight sector modules, from Financial Services to OT & Critical Infrastructure, add four or five questions each to Standard and Full.

An example question and its evidence

Here is the first Governance & Ownership question:

Our executive leadership has been briefed on quantum risk, and the briefing is documented.

Under “What counts”, the help text explains that documented means minutes or a board paper, so the briefing can be shown later to an auditor or a supervisor. Partial means individual executives know about the risk, but nobody documented a briefing.

You will find a help text like this under every question. From these help texts you learn what auditors and supervisors will ask to see.

What the results include

The results start with three headline figures:

  • the readiness level, with the lowest domain named
  • the Crypto-Agility level
  • the earliest dated obligation for the jurisdictions and sectors you selected

Below them are a recommended starting point in the lowest domain and the five highest-priority actions. For each domain there is a checklist of what good looks like at the next level, with actions for the next three months, for three to twelve months, and for later. Every Don’t know appears on a separate list of knowledge gaps.

The roster behind the obligations, dated 18 October 2026, has 45 regulations, mandates and standards. Forty come from 22 jurisdictions, and five apply globally. Thirty-nine have an enforcement tier. Tiers 1 to 3 are mandatory: a market-access gate, a supervisory directive or a binding government mandate. Tiers 4 and 5 are guidance and advisory frameworks.

You can export:

  • a full report as a PDF
  • a one-page board summary that follows the framework’s Quarterly Board Report Template
  • your answers and the findings as CSV files
  • a CycloneDX 1.7 attestation, a machine-readable record of your answers
  • an assessment file, to continue later or share with a classmate

Your answers stay in your browser

The scorecard saves your answers in your browser’s local storage. Nothing you enter is sent to a server, so you can assess your employer without sharing its weak points with anyone, including us. Handle the exported files like any internal security document. The “Your data” section at the bottom of the scorecard has a button that erases all saved answers, notes and history.

Seven exercises for course participants

  1. Find the weakest domain. Run the Quick set for your organization or your case-study company. Write down the lowest domain and the first question at its next level that you cannot answer Yes. Then compare your choice of first step with the “Start here” line in the results.
  2. Check your Yes answers against the evidence. Choose five questions you answered Yes. Open “What counts” for each, and name the document or record you would show an auditor. Change any answer you cannot support with a record, and see whether the level drops.
  3. Turn Don’t know into a contact list. For each knowledge gap, identify who can answer it: for example, the CISO, head of procurement, an enterprise architect, legal counsel or risk staff. Compare your list with a classmate’s.
  4. Compare regulatory exposure. Tick one jurisdiction and note the earliest obligation and its tier. Add a second jurisdiction, or a sector such as Payments, and note what changes. Explain how you would respond differently to a tier 2 supervisory directive and to a tier 4 guidance document.
  5. Plan a crypto-agility rehearsal. Answer the Crypto-Agility questions in the Full set. Choose one system and plan a timed algorithm change in staging, with a rollback. The framework times four steps separately: assessment, decision, change and verification. Estimate each step for your system, and name the person who approves the change.
  6. Brief the board in one page. Export the executive summary. Write three sentences a director could act on: the readiness level and the reason for it, the earliest obligation, and the one decision you need from the board. The note at the foot of the summary lists the board KPIs a self-assessment cannot measure. Say where your organization would get that data.
  7. Read the CycloneDX attestation. Export the attestation and open it in a text editor. Find the scorecard’s requirements under definitions. Under declarations, find the conformance scores for three of your answers: 1 for Yes, 0.5 for Partial and 0 for No. Discuss what a supervisor or a customer could do with this file that they cannot do with a PDF.

Courses that go deeper on each domain

Once you know your lowest domain, these Quantum Academy courses cover it in depth:

If you lead a migration program, the Post-Quantum Certified Manager (PQCM) certification focuses on program leadership, governance and regulatory compliance.

You can continue with two other tools. The PQC Migration Advisor maps the algorithms you use today to their post-quantum or hybrid replacements. The Global PQC Migration Timeline shows the deadlines by region and sector. Run the scorecard again after a course, or six months later at work, and compare the domain levels.